Clients have duplicate mac addresses

bmarien

Hi All,

I have a vpn installation with 250 clients, of which normally there are abouts 50 concurrent connections.
I have noticed that some clients are at times difficult to connect to.

I dug arround in the logs en found that certain clients seem to have duplicate mac adresses. In the logs it looks like this:

Thu	Feb	16	9:48:34	2012	bednet-0171/81.241.232.55:57777 MULTI: Learn: 00:ff:80:64:f7:09 -> bednet-0171/81.241.232.55:57777
Thu	Feb	16	9:48:37	2012	bednet-0109/217.136.229.169:52358 MULTI: Learn: 00:ff:80:64:f7:09 -> bednet-0109/217.136.229.169:52
Thu	Feb	16	9:48:38	2012	bednet-0171/81.241.232.55:57777 MULTI: Learn: 00:ff:80:64:f7:09 -> bednet-0171/81.241.232.55:57777
Thu	Feb	16	9:49:09	2012	bednet-0109/217.136.229.169:52358 MULTI: Learn: 00:ff:80:64:f7:09 -> bednet-0109/217.136.229.169:52

All clients have a ccd to assign static ip etc...

I've parsed the log in excel en at the moment there are 36 clients "sharing" 7 Mac addresses.

Basically, what i'm looking for is
1. The cause of this behavior (so to prevent this in the future).
2. A way of fixing this. -> All clients are on remote addresses so this has to be done via a script (which i can push to these clients).

Anyone any ideas?

Thanks in advace!

janjust

which OS is running on these clients? On windows machines , the tap-win32 adapter MAC address is set at install time. If these installations are cloned (either using ghost or some virtual machine tools) then you'd run into this problem.

On Linux (and IIRC, MacOS) the MAC address is chosen randomly when the adapter is brought up - so the chance that there's overlap on those boxen is minimal.

bmarien

These are all windows clients (xp vista and 7)

All machines are indeed cloned, but, installation of the vpn client is only run by script after the cloning has taken place.
I'm not sure what data is used to gen the mac, but would it be possible that clients gen identical mac's as they are cloned by mulitcast. Meaning 20 machines at the same time would run the installer?

How can i make the client software generate a new mac?

janjust

this is taken from the source code of the tap-win32 driver:

/*
* Generate a MAC using the GUID in the adapter name.
*
* The mac is constructed as 00:FF:xx:xx:xx:xx where
* the Xs are taken from the first 32 bits of the GUID in the
* adapter name. This is similar to the Linux 2.4 tap MAC
* generator, except linux uses 32 random bits for the Xs.
*
* In general, this solution is reasonable for most
* applications except for very large bridged TAP networks,
* where the probability of address collisions becomes more
* than infintesimal.
*/

so if the software is installed but not configured before the ghosting process takes place then you have a fair chance of ending up with the same MAC address.

A quick&dirty solution is to remove and recreate the TAP adapter:

tapinstall.exe remove tap0901
tapinstall.exe install tap0901

bmarien

Great, that seems to be the route.

For a moment i tought i was saved.In the bin folder in the installation directory of the win openvpn client there already are two bat files for adding and removing tap adapters:
addtap.bat
deltapall.bat

All I needed to two was melt these two together en push the script.

@echo off
Echo Updating network configuration.
Echo Please wait ...
"C:\Program Files\OpenVPN\bin\tapinstall.exe" remove tap0901
"C:\Program Files\OpenVPN\bin\tapinstall.exe" install "C:\Program Files\OpenVPN\driver\OemWin2k.inf" tap0901

Unfortunatly... you always get this windows logo message prompting whether you are sure you want to install this driver. Making it impossible so far to script the install.

I extracted the driver from a fresh copy here: http://openvpn.net/index.php/open-source/downloads.html According to this page https://community.openvpn.net/openvpn/wiki/ManagingWindowsTAPDrivers these drivers should be signed, but that didn't do the trick.

I've also read about disabling the signature validation check but this does not seem to be scriptable due a hashcode in the XP registry which wil reset it to its default value and in vista its enforced by MS and will also auto re-enable on reboot.

But apart from the above obstakels running the installer does actually gen a new mac address.

Anyone any ideas?
Otherwise i looks like i'll have to remote in to these conflicting machines.